Two-factor authentication (2FA)

Why it matters for WordPress

Passwords leak from other sites, phishing, and shared agency logins. 2FA means the password alone should not open wp-admin. For site owners and agencies, it is one of the highest-value controls you can turn on in an afternoon.

How it shows up in practice

• An authenticator prompt after the password on Administrator (and ideally Editor)
• Recovery codes stored offline for a lost phone
• Stuffing attempts that succeed on the password step, then fail without the code
• Support tickets from staff who need a recovery path after a device change

What to do

1. Require 2FA for all privileged roles, not only your personal admin.
2. Store recovery codes somewhere safe (ideally not in the same note as the password).
3. Prefer app-based TOTP over SMS when you have the choice.
4. Keep login rate limits on so stuffing still costs the attacker time.

In WP Security Ninja

Two-factor authentication adds app or email codes for key roles. Use it with login protection so bots cannot spray forever while someone without 2FA still sits on Administrator. Broader login hardening: WordPress login security guide.